Red Hat Product Errata RHSA-2025:8481 - Security Advisory
Issued:
2025-06-04
Updated:
2025-06-04

RHSA-2025:8481 - Security Advisory

Synopsis

Important: libsoup security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for libsoup is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The libsoup packages provide an HTTP client and server library for GNOME.

Security Fix(es):

  • libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content (CVE-2025-2784)
  • libsoup: Denial of Service attack to websocket server (CVE-2025-32049)
  • libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process (CVE-2025-32914)
  • libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0 s390x

Fixes

  • BZ - 2354669 - CVE-2025-2784 libsoup: Heap buffer over-read in `skip_insignificant_space` when sniffing content
  • BZ - 2357066 - CVE-2025-32049 libsoup: Denial of Service attack to websocket server
  • BZ - 2359358 - CVE-2025-32914 libsoup: OOB Read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
  • BZ - 2367183 - CVE-2025-4948 libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.0

SRPM
libsoup-2.72.0-8.el9_0.5.src.rpm SHA-256: 66a74313b9fbdbe747f591c598b8d74329b3b68b584975ff5728a113d083ff4b
ppc64le
libsoup-2.72.0-8.el9_0.5.ppc64le.rpm SHA-256: 5ec7dec91e87c4c2ff483c65ebec926d06e4f3c410668d9fbb5279e4dfa133f6
libsoup-debuginfo-2.72.0-8.el9_0.5.ppc64le.rpm SHA-256: 2fc64db39f464f30de559a1068cfe691f8a97a192ab627df8a9f3ef0475520f0
libsoup-debugsource-2.72.0-8.el9_0.5.ppc64le.rpm SHA-256: 8969a8917837db9320f77ba46f8b9c59ffef049dc41f37f8082c644bbd0fcd83
libsoup-devel-2.72.0-8.el9_0.5.ppc64le.rpm SHA-256: a6aad156ad17649e9d4b44b6f16f62a3dd234fd92bcf7b5934d2973870f0be25

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.0

SRPM
libsoup-2.72.0-8.el9_0.5.src.rpm SHA-256: 66a74313b9fbdbe747f591c598b8d74329b3b68b584975ff5728a113d083ff4b
x86_64
libsoup-2.72.0-8.el9_0.5.i686.rpm SHA-256: baffd7460bb77c782fe3335b76441c6c9f39f43600cd8c04f405d1d5016d21a9
libsoup-2.72.0-8.el9_0.5.x86_64.rpm SHA-256: 142705dca78c324c7ce0322da18bc7f36c96b9b6a2be7a4b878eebf6fcd6d4ee
libsoup-debuginfo-2.72.0-8.el9_0.5.i686.rpm SHA-256: 68f30a74fab0114c94a1f32a6286e920227272371ea42799b7f5b5d273dad863
libsoup-debuginfo-2.72.0-8.el9_0.5.x86_64.rpm SHA-256: 79a950dc01fd54fa4cde5d2bbf28cfeb932cf846f2eb0530b8f333d6082f0879
libsoup-debugsource-2.72.0-8.el9_0.5.i686.rpm SHA-256: 29679005dcdbc5573d9ecd2d4890807ef027b2524797d7da13f111b3a5413eb0
libsoup-debugsource-2.72.0-8.el9_0.5.x86_64.rpm SHA-256: d59ce91e7686aeb1c901a339f18944bb8e84b5fce19567252874dcd96739d887
libsoup-devel-2.72.0-8.el9_0.5.i686.rpm SHA-256: f4499eb802340404d7e6f4b820dd4dd53a661e1e264cd1c840944f5d3ff3298a
libsoup-devel-2.72.0-8.el9_0.5.x86_64.rpm SHA-256: 9da4d29a35e8bbe4e960fa027d1071ade1dcf630051fe4047e066b09faf4905b

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.0

SRPM
libsoup-2.72.0-8.el9_0.5.src.rpm SHA-256: 66a74313b9fbdbe747f591c598b8d74329b3b68b584975ff5728a113d083ff4b
aarch64
libsoup-2.72.0-8.el9_0.5.aarch64.rpm SHA-256: 954e75fb0cab4865bd45a7bc0f3d76c5d6e63dcc8f1cba0a0d0b013c79d7f347
libsoup-debuginfo-2.72.0-8.el9_0.5.aarch64.rpm SHA-256: 01883905f3cfdc103acb13eb81bb0bb0a622d40c7cc7d85d2fe4be3ad13eebbd
libsoup-debugsource-2.72.0-8.el9_0.5.aarch64.rpm SHA-256: 53acbf840c15072ba0b7a7120e20d90b1543ccb42dc07a5754d07b339092f838
libsoup-devel-2.72.0-8.el9_0.5.aarch64.rpm SHA-256: 710cf94dea0dbf284d01793c53d6cfc4aecae1a143a686f8c13362f04262c9a4

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.0

SRPM
libsoup-2.72.0-8.el9_0.5.src.rpm SHA-256: 66a74313b9fbdbe747f591c598b8d74329b3b68b584975ff5728a113d083ff4b
s390x
libsoup-2.72.0-8.el9_0.5.s390x.rpm SHA-256: a5db21bcfeb6470aabbbcaeda7642b5b83a70fc5aafff68568ff22a2bfbc83a1
libsoup-debuginfo-2.72.0-8.el9_0.5.s390x.rpm SHA-256: de8117a7e891373b3c00ff5f8864e657cc2bc6364d8828bea240d1c68e6b381e
libsoup-debugsource-2.72.0-8.el9_0.5.s390x.rpm SHA-256: ab13908833845517ee424e9c08232a28ed7c39d7e54d08fcfeef35833d5f83b0
libsoup-devel-2.72.0-8.el9_0.5.s390x.rpm SHA-256: c0464d86ed4f1ea648f2f87b474af398e58b0a8e8f7f01a74b2ea10a87e9dce3

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.